Third Party Access Granted - Postmortem on Student Privacy

Explore a comprehensive postmortem analysis of student privacy vulnerabilities in higher education systems through this 36-minute DEF CON 33 conference talk. Examine the critical intersection of student data protection, third-party access controls, and institutional privacy practices as presented by a business analyst with extensive experience in enterprise student systems. Delve into real-world case studies and lessons learned from privacy incidents, understanding how student data pipelines, consent mechanisms, and access management can fail in academic environments. Learn about the unique challenges facing educational institutions in balancing operational needs with privacy protection, including the complexities of managing third-party vendor relationships and data sharing agreements. Gain insights into the value and vulnerability of student data, discover common security gaps in academic systems, and understand the regulatory landscape governing educational privacy. Benefit from the presenter's interdisciplinary perspective combining social work principles, cybersecurity risk management, and practical experience in agile development environments to understand both the technical and human elements of student privacy protection.